❌ Public Clouds & Shared Responsibility: Lessons from Vulnerability Disclosure ❌
📖 Read
via "Threat Post".
Much is made of shared responsibility for cloud security. But Oliver Tavakoli, CTO at Vectra AI, notes there's no guarantee that Azure or AWS are delivering services in a hardened and secure manner.📖 Read
via "Threat Post".
Threat Post
Public Clouds & Shared Responsibility: Lessons from Vulnerability Disclosure
Much is made of shared responsibility for cloud security. But Oliver Tavakoli, CTO at Vectra AI, notes there's no guarantee that Azure or AWS are delivering services in a hardened and secure manner.
‼ CVE-2019-3556 ‼
📖 Read
via "National Vulnerability Database".
HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the filesystem to write this data. The parameter is not validated, allowing a malicious user to overwrite arbitrary files where the user running HHVM has write access. This issue affects HHVM versions prior to 4.56.2, all versions between 4.57.0 and 4.78.0, as well as 4.79.0, 4.80.0, 4.81.0, 4.82.0, and 4.83.0.📖 Read
via "National Vulnerability Database".
🕴 North Korea's Lazarus Group Turns to Supply Chain Attacks 🕴
📖 Read
via "Dark Reading".
State-backed group is among a growing number of threat actors looking at supply chain companies as an entry point into enterprise networks.📖 Read
via "Dark Reading".
Dark Reading
North Korea's Lazarus Group Turns to Supply Chain Attacks
State-backed group is among a growing number of threat actors looking at supply chain companies as an entry point into enterprise networks.
❌ SquirrelWaffle Loader Malspams, Packing Qakbot, Cobalt Strike ❌
📖 Read
via "Threat Post".
Say hello to what could be the next big spam player: SquirrelWaffle, which is spreading with increasing frequency via spam campaigns and infecting systems with a new malware loader.📖 Read
via "Threat Post".
Threat Post
SquirrelWaffle Loader Malspams, Packing Qakbot, Cobalt Strike
SquirrelWaffle, a new malware loader, is mal-spamming malicious Microsoft Office documents to deliver Qakbot malware and the penetration-testing tool Cobalt Strike – two of the most common threats regularly observed targeting organizations around the world.…
🕴 Free Tool Helps Security Teams Measure Their API Attack Surface 🕴
📖 Read
via "Dark Reading".
Data Theorem's free API Attack Surface Calculator helps security teams understand potential API exposures.📖 Read
via "Dark Reading".
Dark Reading
Free Tool Helps Security Teams Measure Their API Attack Surface
Data Theorem's free API Attack Surface Calculator helps security teams understand potential API exposures.
‼ CVE-2021-23877 ‼
📖 Read
via "National Vulnerability Database".
Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary code as the admin user by replacing a specific temporary file created during the installation of the trial version of MTP.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-22864 ‼
📖 Read
via "National Vulnerability Database".
A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor 3.1.0 allows attackers to execute arbitrary web scripts or HTML.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41866 ‼
📖 Read
via "National Vulnerability Database".
MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.📖 Read
via "National Vulnerability Database".
❌ Cyber Attack Cripples Iranian Fuel Distribution Network ❌
📖 Read
via "Threat Post".
The incident triggered shutdowns at pumps across the country as attackers flashed the phone number of Supreme Leader Ali Khamenei across video screens.📖 Read
via "Threat Post".
Threat Post
Cyberattack Cripples Iranian Fuel Distribution Network
The incident triggered shutdowns at pumps across the country as attackers flashed the phone number of Supreme Leader Ali Khamenei across video screens.
🗓️ Attack the block – How a security researcher cracked 70% of urban WiFi networks in one hit 🗓️
📖 Read
via "The Daily Swig".
A new attack takes advantage of weak WiFi passwords📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Attack the block – How a security researcher cracked 70% of urban WiFi networks in one hit
A new attack takes advantage of weak WiFi passwords
🕴 Identity-Focused Security Controls Prevail 🕴
📖 Read
via "Dark Reading".
How identity and access management strategies held up during the pandemic and tips for putting together an identity security road map.📖 Read
via "Dark Reading".
Dark Reading
Identity-Focused Security Controls Prevail
How identity and access management strategies held up during the pandemic and tips for putting together an identity security road map.
🕴 Annual Cyber Risk Survey Finds Businesses Are Sharpening Their Focus on Cybersecurity but Also Reveals Much Room for Improvement in Building Cyber-Resilience 🕴
📖 Read
via "Dark Reading".
This year's survey features the highest percentage of cyber insurance buyers since the beginning of the survey 11 years ago.📖 Read
via "Dark Reading".
Dark Reading
Annual Cyber Risk Survey Finds Businesses Are Sharpening Their Focus on Cybersecurity but Also Reveals Much Room for Improvement…
This year's survey features the highest percentage of cyber insurance buyers since the beginning of the survey 11 years ago.
🕴 Cynerio Launches IoT Attack Detection and Response Module for Healthcare IoT Devices 🕴
📖 Read
via "Dark Reading".
Module helps hospitals identify, contain, and mitigate threats on devices exhibiting malicious or suspicious behavior.📖 Read
via "Dark Reading".
Dark Reading
Cynerio Launches IoT Attack Detection and Response Module for Healthcare IoT Devices
Module helps hospitals identify, contain, and mitigate threats on devices exhibiting malicious or suspicious behavior.
🕴 Onfido Acquires EYN to Provide Acoustic-Based Liveness Detection 🕴
📖 Read
via "Dark Reading".
Technology will be incorporated into Onfido’s Real Identity Platform.📖 Read
via "Dark Reading".
Dark Reading
Onfido Acquires EYN to Provide Acoustic-Based Liveness Detection
Technology will be incorporated into Onfido’s Real Identity Platform.
🕴 Cyber Readiness Institute Names Karen S. Evans as New Managing Director 🕴
📖 Read
via "Dark Reading".
Former assistant secretary for cybersecurity, energy security, and emergency response at US Department of Energy and Homeland Security CIO to lead strategic vision and day-to-day operations.📖 Read
via "Dark Reading".
Dark Reading
Cyber Readiness Institute Names Karen S. Evans as New Managing Director
Former assistant secretary for cybersecurity, energy security, and emergency response at US Department of Energy and Homeland Security CIO to lead strategic vision and day-to-day operations.
🕴 Avast Business Introduces Network Discovery for SMBs 🕴
📖 Read
via "Dark Reading".
Avast's Network Discovery enables network administrators to easily analyze their entire IT network and deploy Avast Business security services.📖 Read
via "Dark Reading".
Dark Reading
Avast Business Introduces Network Discovery for SMBs
Avast's Network Discovery enables network administrators to easily analyze their entire IT network and deploy Avast Business security services.
🕴 ThycoticCentrify Integrates Secret Server With Privileged Access Management Platform 🕴
📖 Read
via "Dark Reading".
Combination avails Secret Server customers to a range of SaaS services.📖 Read
via "Dark Reading".
Dark Reading
ThycoticCentrify Integrates Secret Server With Privileged Access Management Platform
Combination avails Secret Server customers to a range of SaaS services.
‼ CVE-2021-41872 ‼
📖 Read
via "National Vulnerability Database".
Skyworth Digital Technology Penguin Aurora Box 41502 has a denial of service vulnerability, which can be exploited by attackers to cause a denial of service.📖 Read
via "National Vulnerability Database".
🗓️ Data breach at Colorado university impacts 30,000 students 🗓️
📖 Read
via "The Daily Swig".
Atlassian vulnerability believed to be attack vector📖 Read
via "The Daily Swig".
portswigger.net
Web Application Security, Testing, & Scanning - PortSwigger
PortSwigger offers tools for web application security, testing, & scanning. Choose from a range of security tools, & identify the very latest vulnerabilities.
🦿 Microsoft warns of new supply chain attacks by Russian-backed Nobelium group 🦿
📖 Read
via "Tech Republic".
The cybercrime group behind the SolarWinds hack remains focused on the global IT supply chain, says Microsoft, with 140 resellers and service providers targeted since May.📖 Read
via "Tech Republic".
🗓️ ‘Professional cybercriminals’ blamed for DDoS attacks against UK telecoms providers 🗓️
📖 Read
via "The Daily Swig".
Packet in, says industry group📖 Read
via "The Daily Swig".
portswigger.net
Web Application Security, Testing, & Scanning - PortSwigger
PortSwigger offers tools for web application security, testing, & scanning. Choose from a range of security tools, & identify the very latest vulnerabilities.